---
title: Cherwell Service Management
slug: connectors/cherwell-service-management
docTags: 
createdAt: 2026-06-09T16:30:14.206Z
---

The Cherwell Service Management connector allows for seamless integration with Swimlane Turbine, enabling the automation of incident and security event management.

Cherwell Service Management is a comprehensive IT service management (ITSM) solution that enables organizations to automate service desk operations and manage IT services efficiently. This connector allows Swimlane Turbine users to integrate with Cherwell, providing streamlined incident management, security event handling, and ticketing capabilities directly within the Swimlane platform. Enhance your security automation workflows with the ability to create, update, close, and retrieve tickets and security events, ensuring rapid response and resolution of IT issues and security incidents.

## Asset Setup or Prerequisites

To utilize the Cherwell Service Management connector within Swimlane Turbine, ensure you have the following prerequisites:

- Custom authentication with Cherwell credentials, which includes:
  - Cherwell Server URL: The base URL for your Cherwell Service Management instance.
  - Username: Your Cherwell user account name.
  - Password: Your Cherwell account password.
  - API Client ID: The unique identifier for your API client registered in Cherwell.

## Capabilities

The Cherwell Service Management integration provides the following capabilities:

- Get Current Tickets by Business Object
- Get Current Tickets for Incidents and Security Events
- Get Business Object Fields
- Create, Close, Update, or Retrieve an Incident by ID
- Create, Close, Update, or Retrieve a Security Event by ID

## Notes About Get Current Tickets Filters

List of available operators.

| Operator   | Description                  |
| ---------- | ---------------------------- |
| eq         | Equals specified value       |
| gt         | Greater than specified value |
| lt         | Less than specified value    |
| contains   | Contains specified value     |
| startswith | Starts with specified value  |

Filters can be built as follows:

```javascript
field,operator,value
```

for example;

```javascript
IncidentID,eq,102401
```

This filter should be passed to QueryStrings input field.

## Notes

Incidents or Security Events in workflow go through these states:

- **New:**  Incident is created, recorded (initial details), classified, and assigned to an owner.
- **Assigned:**  Incident is assigned to an owner.
- **In Progress:**  The incident is being investigated/fulfilled and resolved by an owner.
- **Pending:** The incident is temporarily paused. (Stop the Clock)
- **Resolved:**  The incident has been resolved and is waiting to be closed.
- **Closed:**  The incident is closed.
- **Reopened:**  The incident is reopened because the issue was not fixed or reoccurred.

# Configurations

## Cherwell Asset

Authenticates using Cherwell credentials

### Configuration Parameters

| **Parameter** | **Description**                    | **Type** | **Required** |
| ------------- | ---------------------------------- | -------- | ------------ |
| url           | The URL of the Cherwell Instance   | string   | Required     |
| username      | Account Username                   | string   | Required     |
| password      | Account Password                   | string   | Required     |
| client\_id    | API Client ID                      | string   | Required     |
| verify\_ssl   | Verify SSL certificate             | boolean  | Optional     |
| http\_proxy   | A proxy to route requests through. | string   | Optional     |

# Actions

## Close Security Event

Closes a specified security event in Cherwell Service Management using the provided SecEventId.

### Input

| **Argument Name** | **Type** | **Required** | **Description**                                                       |
| ----------------- | -------- | ------------ | --------------------------------------------------------------------- |
| `SecEventId`      | string   | Required     | The unique identifier for the security event that needs to be closed. |

### Input Example

`{"SecEventId":"100577"}`

### Output

| **Parameter** | **Type** | **Description**                  |
| ------------- | -------- | -------------------------------- |
| `status_code` | number   | HTTP status code of the response |
| `reason`      | string   | Response reason phrase           |

### Output Example

`{"status_code":200,"reason":"OK","response_headers":{},"json_body":{}}`

## Close Ticket

Closes an incident ticket in Cherwell Service Management using the provided IncidentId.

### Input

| **Argument Name** | **Type** | **Required** | **Description**                                                        |
| ----------------- | -------- | ------------ | ---------------------------------------------------------------------- |
| `IncidentId`      | string   | Required     | The unique identifier for the incident ticket that needs to be closed. |

### Input Example

`{"IncidentId":"102999"}`

### Output

| **Parameter** | **Type** | **Description**                  |
| ------------- | -------- | -------------------------------- |
| `status_code` | number   | HTTP status code of the response |
| `reason`      | string   | Response reason phrase           |

### Output Example

`{"status_code":200,"reason":"OK","response_headers":{},"json_body":{}}`

## Create Security Event

Create a new security event in Cherwell Service Management with specified priority, source, date/time, and details.

### Input

| **Argument Name**         | **Type** | **Required** | **Description**                                                                     |
| ------------------------- | -------- | ------------ | ----------------------------------------------------------------------------------- |
| `Priority`                | string   | Required     | The priority level of the security event. Allowed values are Low, Normal, and High. |
| `EventSource`             | string   | Required     | The source or origin of the security event.                                         |
| `EventDateTime`           | string   | Required     | The date and time when the security event occurred.                                 |
| `Details`                 | string   | Required     | Additional information or description of the security event.                        |
| `RecID`                   | string   | Optional     | A unique identifier for the security event record.                                  |
| `EventOperationsTypeID`   | string   | Optional     | The ID of the event operations type.                                                |
| `EventOperationsTypeName` | string   | Optional     | The name of the event operations type.                                              |
| `CreatedDateTime`         | string   | Optional     | The date and time when the event was created.                                       |
| `CreatedBy`               | string   | Optional     | The name of the person who created the event.                                       |
| `CreatedByID`             | string   | Optional     | The ID of the person who created the event.                                         |
| `CreatedCulture`          | string   | Optional     | The culture or language settings under which the event was created.                 |
| `LastModDateTime`         | string   | Optional     | The date and time when the event was last modified.                                 |
| `LastModBy`               | string   | Optional     | The person or system that last modified the event.                                  |
| `LastModByID`             | string   | Optional     | The identifier of the person or system that last modified the event.                |
| `OwnedBy`                 | string   | Optional     | The name of the person or team responsible for managing the event.                  |
| `OwnedByID`               | string   | Optional     | The identifier of the person or team responsible for the event.                     |
| `OwnedByTeam`             | string   | Optional     | The team responsible for managing the security event.                               |
| `OwnedByTeamID`           | string   | Optional     | The identifier for the team managing the event.                                     |
| `EventOperationsID`       | string   | Optional     | The identifier of the event operational process.                                    |
| `ReportedBy`              | string   | Optional     | The name of the person or entity that reported the security event.                  |
| `ReportedByEmail`         | string   | Optional     | The email address of the person who reported the event.                             |
| `ReportedByPhone`         | string   | Optional     | The phone number of the person who reported the event.                              |
| `Discovery`               | string   | Optional     | Information about how the event was discovered.                                     |
| `EventCI`                 | string   | Optional     | The configuration item related to the security event.                               |
| `Status`                  | string   | Optional     | The current status of the security event.                                           |

### Input Example

`{"Priority":"string","EventSource":"string","EventDateTime":"string","Details":"string","RecID":"string","EventOperationsTypeID":"string","EventOperationsTypeName":"Example Name","CreatedDateTime":"string","CreatedBy":"string","CreatedByID":"string","CreatedCulture":"string","LastModDateTime":"string","LastModBy":"string","LastModByID":"string","OwnedBy":"string","OwnedByID":"string","OwnedByTeam":"string","OwnedByTeamID":"string","EventOperationsID":"string","ReportedBy":"string","ReportedByEmail":"string","ReportedByPhone":"string","Discovery":"string","EventCI":"string","Status":"active","Hostname":"Example Name","SrcIPAddress":"string","Source":"string","Level":"string","Service":"string","DestIPAddress":"string","AttachedToSecurityIncident":"string","CIType":"string","NetworkEventType":"string","RunbookName":"Example Name","ISMSSecurityEventID":"string","IncidentID":"string","ChangeRequestID":"string","CauseCode":"string","OwnedByEmail":"string","OwnedByPhone":"string","RequesterID":"string","ConfigurationItemID":"string","EventResponseNotes":"string","CIRisk":"string","SupportingServiceRisk":"string","ISMSCIRiskAssessmentID":"string","CIRiskAssessmentID":"string","LastModTimeStamp":"string","PrimaryConfigItemRecID":"string"}`

### Output

| **Parameter** | **Type** | **Description**                  |
| ------------- | -------- | -------------------------------- |
| `status_code` | number   | HTTP status code of the response |
| `reason`      | string   | Response reason phrase           |

### Output Example

`{"status_code":200,"reason":"OK","response_headers":{},"json_body":{}}`

## Create Ticket

Generates a new incident ticket in Cherwell Service Management with details like customer name, description, priority, service, and source.

### Input

| **Argument Name**           | **Type** | **Required** | **Description**                                                                                            |
| --------------------------- | -------- | ------------ | ---------------------------------------------------------------------------------------------------------- |
| `CustomerDisplayName`       | string   | Required     | The name of the customer reporting the issue (e.g., Max Megalos).                                          |
| `Summary`                   | string   | Optional     | A brief summary of the issue.                                                                              |
| `Description`               | string   | Required     | A detailed description of the problem (e.g., Cannot print to network printer).                             |
| `Priority`                  | string   | Required     | The urgency of the issue, ranging from Low to High.                                                        |
| `Service`                   | string   | Required     | The affected service, such as E-mail, Desktop Management, or Network Services.                             |
| `Category`                  | string   | Optional     | A broad classification of the issue, covering areas like Network Access, Anti-Virus, or Misc. Software.    |
| `Subcategory`               | string   | Optional     | A more specific breakdown of the category, such as New Account, Password Reset, or Request New Computer.   |
| `Source`                    | string   | Required     | How the issue was reported, whether via Walk-in, E-mail, Phone, or another method.                         |
| `LastModByID`               | string   | Optional     | The ID of the user who last modified the ticket.                                                           |
| `CreatedByEmail`            | string   | Optional     | The email address of the user who created the ticket (e.g., [user@example.com](mailto\:user@example.com)). |
| `Comments`                  | string   | Optional     | Additional comments or updates about the ticket (e.g., Withdrawn by Henri Bryce).                          |
| `RecurringIncident`         | string   | Optional     | Whether the incident is recurring (e.g., 'False').                                                         |
| `ReviewByDeadline`          | string   | Optional     | A deadline by which the incident should be reviewed (e.g., 2/14/2018 12:00:00 AM).                         |
| `CustomerTypeID`            | string   | Optional     | The customer type identifier.                                                                              |
| `NextStatusOneStep`         | string   | Optional     | Information about the next status step for the ticket.                                                     |
| `OwnedByManager`            | string   | Optional     | The name of the manager responsible for the ticket (e.g., Gina Mehra).                                     |
| `Level3EscalationTeam`      | string   | Optional     | The team handling the third-level escalation (e.g., 3rd Level Support).                                    |
| `TasksOnHold`               | string   | Optional     | Whether tasks related to the incident are on hold (e.g., 'False').                                         |
| `NextStatusText`            | string   | Optional     | The next status text for the incident.                                                                     |
| `SLA_Key`                   | string   | Optional     | The Service Level Agreement key (e.g., Platinum\_Incident).                                                |
| `error_Message`             | string   | Optional     | Any error messages associated with the ticket.                                                             |
| `CIDowntimeInMinutes`       | string   | Optional     | The duration of configuration item downtime, in minutes (e.g., 300).                                       |
| `Withdraw`                  | string   | Optional     | Whether the incident has been withdrawn (e.g., 'False').                                                   |
| `CustomerSubscriptionLevel` | string   | Optional     | The customer subscription level (e.g., Gold).                                                              |
| `SCTFired`                  | string   | Optional     | Whether an SCT (Service Configuration Template) was fired.                                                 |

### Input Example

`{"CustomerDisplayName":"Max Megalos","Description":"Cannot print to network printer","Priority":"1","Service":"Account Management,Conferencing/Presentation,Desktop Management,E-Mail/Calendaring,Employee Support,Enterprise Apps, IT ServiceDesk,Network Services,Printing,Telephone/Fax or Web Services","Category":"Network Access,Cherwell Self Service,Video/Audio Conferencing,Equipment Request,Computer,OS,Anti-Virus,Misc. Software,Desktop Client,Mobile Client,Browser Client,","Subcategory":"Submit Incident","Source":"Event","LastModByID":"93546560c6334c3c105d17437c843b9557775b2e0c","CreatedByEmail":"user@example.com","Comments":"Withdrawn by Henri Bryce on 3/10/2016 7:44 AM via the Company Portal. Removed from cart by customer.","RecurringIncident":"False","ReviewByDeadline":"2/14/2018 12:00:00 AM","CustomerTypeID":"93405caa107c376a2bd15c4c8885a900be316f3a72","NextStatusOneStep":"<Trebuchet><ActionInfoDef ID=93d969b712f8","OwnedByManager":"Gina Mehra","Level3EscalationTeam":"3rd Level Support","TasksOnHold":"False","SLA_Key":"Platinum_Incident","CIDowntimeInMinutes":"300","Withdraw":"False","CustomerSubscriptionLevel":"Gold","SCTFired":"True or False","SLAIDForCI":"93838607346b42be7074af487d9171ea9f948b7204","CreatedDuring":"8 to 5 Monday thru Friday","ApprovalBlockID":"93838607346b42be7074af487d9171ea9f948b7204","TotalSTCTimeInMinutes":"0","OwnedBy":"Josh Wilson","CloseDescription":"Had the user reset their password and they were able to login.","SLANameForCustomer":"Platinum","Stat_DateTimeAssigned":"2/18/2019 2:04:02 PM","DefaultTeam":"1st Level Support","PendingReason":"Pending Change Request","SLAName":"Platinum","SLAResponseWarning":"2/18/2019 2:17:02 PM","Location":"Colorado Springs","SLAResolveByDeadline":"2/19/2019 11:03:00 AM","Stat_DateTimeResolved":"2/18/2019 2:15:10 PM","ServiceCartID":"94158f8a42539e9020253a4eaeb4001971f311bbcd","ClosedBy":"Cherwell Admin","ClonedIncident":"True or False","ChangeID":"93ecd360afc8bf81a79b914d5eba8f20be72a897b1","PendingStartDateTime":"3/18/2019 8:05:00 AM","NextStatus":"Begin Work, Set Pending, Resolve, Close, Reopen","StatusID":"cc7383192e644834b6531d0da56194e5","ConfigItemTypeID":"cc7383192e644834b6531d0da56194e5","STCTimeInMinutes":"20","LastModifiedDateTime":"12/10/2019 12:11:29 PM","ConfigItemRecID":"93db88a5ec5a67c46945d34b2fa692b603e191c6a2","CreatedDateTime":"2/18/2019 2:02:02 PM","CallSource":"Walk in or Social Media or E-mail or Event or Portal or Chat Session or Mobile","MajorIncidentID":"100577","ServiceID":"93838695cf676f6dccef2c42a9a630ed0b8085613f","WasCIDown":"False","Urgency":"High","Stat_FirstCallResolution":"False","LastModBy":"Cherwell Admin","IncidentchildRecID":"93838695cf676f6dccef2c42a9a630ed0b8085613f","ClonedIncidentID":"100345","SLARespondByDeadline":"2/18/2019 2:32:02 PM","SLAID":"93838607346b42be7074af487d9171ea9f948b7204","ClosedOn1stCall":"False","Impact":"Individual or Company or Whenever Possible","Stat_SLAResolutionGood":"True","SmartClassifySearchString":"Submit Incident or New Employee Setup","MajorIncidentRecID":"93d605eb8ffd63610adfb24cf0ac81f502d967098b","LinkedProblem":"93db8594ca1d42fd7c59c94302995fbb8d91e69383","TotalTasks":"0.0","TasksClosed":"False","PortalAffectsMultipleUsers":"False","ShowContactInformation":"True or False","Status":"New,Assigned,In Progress,Pending,Resolved,Closed or Reopened","CIDownEndDateTime":"2/19/2019 10:48:00 AM","type_name":"Incident","TotalTaskTime":"0.00","Level2EscalationComplete":"True","PendingPreviousStatus":"In Progress","SLAIDForCustomer":"93838607346b42be7074af487d9171ea9f948b7204","Stat_DateTimeResponded":"2/18/2019 2:08:02 PM","RequesterDepartment":"Administration or Sales & Marketing or Accounting.","IncidentchildID":"93546560c6334c3c105d17437c843b9557775b2e0c","busObPublicId":"100576","busObId":"6dd53665c0c24cab86870a21cf6434ae","ClosedDateTime":"2/19/2019 8:58:03 AM","Stat_DateTimeInProgress":"2/18/2019 2:08:02 PM","IncidentDurationInDays":"0.79","Level3EscalationComplete":"True or False","TasksInProgress":"False","IncidentType":"Incident","CIDownStartDateTime":"2/19/2019 10:48:00 AM","MajorIncident":"True","CreatedByID":"9365b5492e73e147d96f0f48cb856c89e3918c5871","RecID":"93d605e29a4a79c71cb4584dc1b5d740a1edeea675","SpecificsTypeId":"9398862125defd58a8deea46fe88acc411a96e2b00","Cause":"Untrained User","Stat_IncidentReopened":"True","busObRecId":"93d605e29a4a79c71cb4584dc1b5d740a1edeea675","ServiceCatalogTemplateName":"HR Process","Stat_NumberOfTouches":"59","OwnedByTeam":"1st Level Support","BreachNotes":"Please describe the delay here: 2nd level support didn't check the ODBC until the next morning","Stat_IncidentEscalated":"False","CustomerRecID":"9349ef7253eba3a1e516744da5bb4ca82ff8f4157c","ConfigItemDisplayName":"max-lap","SLAResolutionWarning":"2/19/2019 10:48:00 AM","Stat_DateTimeClosed":"2/18/2019 2:30:10 PM","ClosedByID":"93546560c6334c3c105d17437c843b9557775b2e0c","Level2EscalationTeam":"2nd Level Support","CreatedBy":"Josh Wilson","OwnedByID":"9365b5492e73e147d96f0f48cb856c89e3918c5871","ServiceEntitlements":"Platinum, Gold, Silver, Corporate","Stat_NumberOfEscalations":"0","StatusDesc":"Incident is closed","LinkedSLAs":"93838607346b42be7074af487d9171ea9f948b7204","PendingEndDateTime":"2/19/2019 10:48:00 AM","TaskClosedCount":"0","OwnedByTeamID":"9365b4e90592c81e3b7a024555a6c0094ba77e8773","IncidentDurationInHours":"18.93","Cost":"709.00"}`

### Output

| **Parameter** | **Type** | **Description**                  |
| ------------- | -------- | -------------------------------- |
| `status_code` | number   | HTTP status code of the response |
| `reason`      | string   | Response reason phrase           |

### Output Example

`{"status_code":200,"reason":"OK","response_headers":{},"json_body":{}}`

## Get Business Object Fields

Retrieves field definitions for a specified business object in Cherwell Service Management using the Business Object Name.

### Input

| **Argument Name** | **Type** | **Required** | **Description**                                                                                                                                                                                                                                                                  |
| ----------------- | -------- | ------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `BusObjName`      | string   | Required     | Specifies the name of the business object for which field definitions are to be retrieved. This value should match an existing business object in Cherwell Service Management, such as 'Incident' or 'SecurityEvent'. The field is required for the action to function properly. |

### Input Example

`{"BusObjName":"Incident or SecurityEvent"}`

### Output

| **Parameter** | **Type** | **Description**                  |
| ------------- | -------- | -------------------------------- |
| `status_code` | number   | HTTP status code of the response |
| `reason`      | string   | Response reason phrase           |

### Output Example

`{"status_code":200,"reason":"OK","response_headers":{},"json_body":{}}`

## Get Current Incidents

Retrieve a list of current incidents from Cherwell Service Management without requiring additional parameters.

### Input

| **Argument Name** | **Type** | **Required** | **Description**                                                                                                                                                |
| ----------------- | -------- | ------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `QueryStrings`    | string   | Optional     | Allows for optional filtering of incidents based on specific criteria. For example, to filter incidents with a specific Incident ID, use IncidentID,eq,102401. |
| `limit`           | number   | Optional     | Specifies the maximum number of incidents to retrieve in the response. This field is optional and helps control the size of the result set.                    |

### Input Example

`{"QueryStrings":"IncidentID,eq,102401","limit":10}`

### Output

| **Parameter** | **Type** | **Description**                  |
| ------------- | -------- | -------------------------------- |
| `status_code` | number   | HTTP status code of the response |
| `reason`      | string   | Response reason phrase           |

### Output Example

`{"status_code":200,"reason":"OK","response_headers":{},"json_body":{}}`

## Get Current Security Events

Retrieve the latest security events from Cherwell Service Management for analysis and tracking.

### Input

| **Argument Name** | **Type** | **Required** | **Description**                                                                                                                                        |
| ----------------- | -------- | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `QueryStrings`    | string   | Optional     | Allows for optional filtering of security events based on specific criteria. For instance, you can filter by Incident ID using IncidentID,eq,102401.   |
| `limit`           | number   | Optional     | Specifies the maximum number of security events to return in the response. This optional field helps manage the volume of data returned by the action. |

### Input Example

`{"QueryStrings":"IncidentID,eq,102401","limit":10}`

### Output

| **Parameter** | **Type** | **Description**                  |
| ------------- | -------- | -------------------------------- |
| `status_code` | number   | HTTP status code of the response |
| `reason`      | string   | Response reason phrase           |

### Output Example

`{"status_code":200,"reason":"OK","response_headers":{},"json_body":{}}`

## Get Current Tickets

Retrieve all current tickets from Cherwell Service Management using the specified Business Object Name.

### Input

| **Argument Name** | **Type** | **Required** | **Description**                                                                                                            |
| ----------------- | -------- | ------------ | -------------------------------------------------------------------------------------------------------------------------- |
| `BusObjName`      | string   | Required     | The name of the Cherwell business object from which tickets will be retrieved.                                             |
| `QueryStrings`    | string   | Optional     | Query strings to filter the search. The format should be a comma-separated list specifying the field, operator, and value. |
| `limit`           | number   | Optional     | The maximum number of tickets to retrieve in the response.                                                                 |

### Input Example

`{"BusObjName":"Incident","QueryStrings":"IncidentID,eq,102401","limit":10}`

### Output

| **Parameter** | **Type** | **Description**                  |
| ------------- | -------- | -------------------------------- |
| `status_code` | number   | HTTP status code of the response |
| `reason`      | string   | Response reason phrase           |

### Output Example

`{"status_code":200,"reason":"OK","response_headers":{},"json_body":{}}`

## Get Security Event by ID

Retrieve detailed information for a specific security event by its unique ID in Cherwell Service Management.

### Input

| **Argument Name** | **Type** | **Required** | **Description**                                                         |
| ----------------- | -------- | ------------ | ----------------------------------------------------------------------- |
| `SecEventId`      | string   | Required     | The unique identifier for the security event that you want to retrieve. |

### Input Example

`{"SecEventId":"100577"}`

### Output

| **Parameter** | **Type** | **Description**                  |
| ------------- | -------- | -------------------------------- |
| `status_code` | number   | HTTP status code of the response |
| `reason`      | string   | Response reason phrase           |

### Output Example

`{"status_code":200,"reason":"OK","response_headers":{},"json_body":{}}`

## Get Ticket by ID

Retrieve detailed information for a specific incident ticket in Cherwell Service Management using the IncidentId.

### Input

| **Argument Name** | **Type** | **Required** | **Description**                                                     |
| ----------------- | -------- | ------------ | ------------------------------------------------------------------- |
| `IncidentId`      | string   | Required     | The unique identifier for the incident ticket you want to retrieve. |

### Input Example

`{"IncidentId":"100577"}`

### Output

| **Parameter** | **Type** | **Description**                  |
| ------------- | -------- | -------------------------------- |
| `status_code` | number   | HTTP status code of the response |
| `reason`      | string   | Response reason phrase           |

### Output Example

`{"status_code":200,"reason":"OK","response_headers":{},"json_body":{}}`

## Update Incident

Updates an existing incident in Cherwell Service Management using the provided IncidentId.

### Input

| **Argument Name**           | **Type** | **Required** | **Description**                                                                             |
| --------------------------- | -------- | ------------ | ------------------------------------------------------------------------------------------- |
| `IncidentId`                | string   | Required     | Updates an existing incident in Cherwell Service Management using the provided Incident ID. |
| `CustomerDisplayName`       | string   | Optional     | Specifies the display name of the customer.                                                 |
| `Description`               | string   | Optional     | Provides a description of the incident or issue.                                            |
| `Priority`                  | string   | Optional     | Defines the priority level of the incident.                                                 |
| `Service`                   | string   | Optional     | Specifies the service involved in the incident.                                             |
| `Category`                  | string   | Optional     | Categorizes the type of issue.                                                              |
| `Subcategory`               | string   | Optional     | Provides a more specific categorization under the main category.                            |
| `Source`                    | string   | Optional     | Identifies the source of the incident.                                                      |
| `LastModByID`               | string   | Optional     | Indicates the ID of the user who last modified the incident.                                |
| `CreatedByEmail`            | string   | Optional     | Provides the email address of the user who created the incident.                            |
| `Comments`                  | string   | Optional     | Allows for additional comments or notes on the incident.                                    |
| `RecurringIncident`         | string   | Optional     | Specifies if the incident is recurring.                                                     |
| `ReviewByDeadline`          | string   | Optional     | Sets a deadline for reviewing the incident.                                                 |
| `CustomerTypeID`            | string   | Optional     | Identifies the type of customer.                                                            |
| `NextStatusOneStep`         | string   | Optional     | Defines the next status step for the incident.                                              |
| `OwnedByManager`            | string   | Optional     | Specifies the manager who owns the incident.                                                |
| `Level3EscalationTeam`      | string   | Optional     | Indicates the team responsible for level 3 escalation.                                      |
| `TasksOnHold`               | string   | Optional     | Specifies whether tasks are on hold for this incident.                                      |
| `NextStatusText`            | string   | Optional     | Provides text for the next status update.                                                   |
| `SLA_Key`                   | string   | Optional     | Identifies the SLA key associated with the incident.                                        |
| `error_Message`             | string   | Optional     | Provides an error message, if applicable.                                                   |
| `CIDowntimeInMinutes`       | string   | Optional     | Tracks the downtime of the Configuration Item in minutes.                                   |
| `Withdraw`                  | string   | Optional     | Indicates whether the incident has been withdrawn.                                          |
| `CustomerSubscriptionLevel` | string   | Optional     | Defines the customer's subscription level.                                                  |
| `SCTFired`                  | string   | Optional     | Tracks if an SCT (Service Catalog Template) was triggered.                                  |

### Input Example

`{"IncidentId":"100577","CustomerDisplayName":"Max Megalos","Description":"Cannot print to network printer","Priority":"1","Service":"Account Management,Conferencing/Presentation,Desktop Management,E-Mail/Calendaring,Employee Support,Enterprise Apps, IT ServiceDesk,Network Services,Printing,Telephone/Fax or Web Services","Category":"Network Access,Cherwell Self Service,Video/Audio Conferencing,Equipment Request,Computer,OS,Anti-Virus,Misc. Software,Desktop Client,Mobile Client,Browser Client,","Subcategory":"Submit Incident","Source":"EVent","LastModByID":"93546560c6334c3c105d17437c843b9557775b2e0c","CreatedByEmail":"user@example.com","Comments":"Withdrawn by Henri Bryce on 3/10/2016 7:44 AM via the Company Portal. Removed from cart by customer.","RecurringIncident":"False","ReviewByDeadline":"2/14/2018 12:00:00 AM","CustomerTypeID":"93405caa107c376a2bd15c4c8885a900be316f3a72","NextStatusOneStep":"<Trebuchet><ActionInfoDef ID=93d969b712f8","OwnedByManager":"Gina Mehra","Level3EscalationTeam":"3rd Level Support","TasksOnHold":"False","SLA_Key":"Platinum_Incident","CIDowntimeInMinutes":"300","Withdraw":"False","CustomerSubscriptionLevel":"Gold","SCTFired":"True or False","SLAIDForCI":"93838607346b42be7074af487d9171ea9f948b7204","CreatedDuring":"8 to 5 Monday thru Friday","ApprovalBlockID":"93838607346b42be7074af487d9171ea9f948b7204","TotalSTCTimeInMinutes":"0","OwnedBy":"Josh Wilson","CloseDescription":"Had the user reset their password and they were able to login.","SLANameForCustomer":"Platinum","Stat_DateTimeAssigned":"2/18/2019 2:04:02 PM","DefaultTeam":"1st Level Support","PendingReason":"Pending Change Request","SLAName":"Platinum","SLAResponseWarning":"2/18/2019 2:17:02 PM","Location":"Colorado Springs","SLAResolveByDeadline":"2/19/2019 11:03:00 AM","Stat_DateTimeResolved":"2/18/2019 2:15:10 PM","ServiceCartID":"94158f8a42539e9020253a4eaeb4001971f311bbcd","ClosedBy":"Cherwell Admin","ClonedIncident":"True or False","ChangeID":"93ecd360afc8bf81a79b914d5eba8f20be72a897b1","PendingStartDateTime":"3/18/2019 8:05:00 AM","NextStatus":"Begin Work, Set Pending, Resolve, Close, Reopen","StatusID":"cc7383192e644834b6531d0da56194e5","ConfigItemTypeID":"cc7383192e644834b6531d0da56194e5","STCTimeInMinutes":"20","LastModifiedDateTime":"12/10/2019 12:11:29 PM","ConfigItemRecID":"93db88a5ec5a67c46945d34b2fa692b603e191c6a2","CreatedDateTime":"2/18/2019 2:02:02 PM","CallSource":"Walk in or Social Media or E-mail or Event or Portal or Chat Session or Mobile","ServiceID":"93838695cf676f6dccef2c42a9a630ed0b8085613f","WasCIDown":"False","Urgency":"High","Stat_FirstCallResolution":"False","LastModBy":"Cherwell Admin","IncidentchildRecID":"93838695cf676f6dccef2c42a9a630ed0b8085613f","ClonedIncidentID":"100345","SLARespondByDeadline":"2/18/2019 2:32:02 PM","SLAID":"93838607346b42be7074af487d9171ea9f948b7204","ClosedOn1stCall":"False","Impact":"Individual or Company or Whenever Possible","Stat_SLAResolutionGood":"True","SmartClassifySearchString":"Submit Incident or New Employee Setup","MajorIncidentRecID":"93d605eb8ffd63610adfb24cf0ac81f502d967098b","LinkedProblem":"93db8594ca1d42fd7c59c94302995fbb8d91e69383","TotalTasks":"0.0","TasksClosed":"False","PortalAffectsMultipleUsers":"False","ShowContactInformation":"True or False","Status":"New,Assigned,In Progress,Pending,Resolved,Closed or Reopened","CIDownEndDateTime":"2/19/2019 10:48:00 AM","type_name":"Incident","TotalTaskTime":"0.00","Level2EscalationComplete":"True","PendingPreviousStatus":"In Progress","SLAIDForCustomer":"93838607346b42be7074af487d9171ea9f948b7204","Stat_DateTimeResponded":"2/18/2019 2:08:02 PM","RequesterDepartment":"Administration or Sales & Marketing or Accouting.","IncidentchildID":"93546560c6334c3c105d17437c843b9557775b2e0c","busObPublicId":"100576","busObId":"6dd53665c0c24cab86870a21cf6434ae","ClosedDateTime":"2/19/2019 8:58:03 AM","Stat_DateTimeInProgress":"2/18/2019 2:08:02 PM","IncidentDurationInDays":"0.79","Level3EscalationComplete":"True or False","TasksInProgress":"False","IncidentType":"Incident","CIDownStartDateTime":"2/19/2019 10:48:00 AM","MajorIncident":"True","CreatedByID":"9365b5492e73e147d96f0f48cb856c89e3918c5871","RecID":"93d605e29a4a79c71cb4584dc1b5d740a1edeea675","SpecificsTypeId":"9398862125defd58a8deea46fe88acc411a96e2b00","Cause":"Untrained User","Stat_IncidentReopened":"True","busObRecId":"93d605e29a4a79c71cb4584dc1b5d740a1edeea675","ServiceCatalogTemplateName":"HR Process","Stat_NumberOfTouches":"59","OwnedByTeam":"1st Level Support","BreachNotes":"Please describe the delay here: 2nd level support didn't check the ODBC until the next morning","Stat_IncidentEscalated":"False","CustomerRecID":"9349ef7253eba3a1e516744da5bb4ca82ff8f4157c","ConfigItemDisplayName":"max-lap","SLAResolutionWarning":"2/19/2019 10:48:00 AM","Stat_DateTimeClosed":"2/18/2019 2:30:10 PM","ClosedByID":"93546560c6334c3c105d17437c843b9557775b2e0c","Level2EscalationTeam":"2nd Level Support","CreatedBy":"Josh Wilson","OwnedByID":"9365b5492e73e147d96f0f48cb856c89e3918c5871","ServiceEntitlements":"Platinum, Gold, Silver, Corporate","Stat_NumberOfEscalations":"0","StatusDesc":"Incident is closed","LinkedSLAs":"93838607346b42be7074af487d9171ea9f948b7204","PendingEndDateTime":"2/19/2019 10:48:00 AM","TaskClosedCount":"0","OwnedByTeamID":"9365b4e90592c81e3b7a024555a6c0094ba77e8773","IncidentDurationInHours":"18.93","Cost":"709.00"}`

### Output

| **Parameter** | **Type** | **Description**                  |
| ------------- | -------- | -------------------------------- |
| `status_code` | number   | HTTP status code of the response |
| `reason`      | string   | Response reason phrase           |

### Output Example

`{"status_code":200,"reason":"OK","response_headers":{},"json_body":{}}`

## Update Security Event

Updates a specific security event in Cherwell Service Management using the provided SecEventId.

### Input

| **Argument Name**         | **Type** | **Required** | **Description**                                                                          |
| ------------------------- | -------- | ------------ | ---------------------------------------------------------------------------------------- |
| `SecEventId`              | string   | Required     | The unique identifier of the security event to be updated.                               |
| `Priority`                | string   | Optional     | Defines the priority level of the security event. Possible values are Low, Normal, High. |
| `EventSource`             | string   | Optional     | The source from which the security event was generated.                                  |
| `EventDateTime`           | string   | Optional     | The date and time when the event occurred.                                               |
| `Details`                 | string   | Optional     | Additional information or details about the security event.                              |
| `RecID`                   | string   | Optional     | The record ID associated with the security event.                                        |
| `EventOperationsTypeID`   | string   | Optional     | The identifier for the type of operation performed on the event.                         |
| `EventOperationsTypeName` | string   | Optional     | The name corresponding to the type of operation performed on the event.                  |
| `CreatedDateTime`         | string   | Optional     | The timestamp of when the security event was created.                                    |
| `CreatedBy`               | string   | Optional     | The individual or system that created the security event.                                |
| `CreatedByID`             | string   | Optional     | The ID of the person or system who created the security event.                           |
| `CreatedCulture`          | string   | Optional     | The cultural settings applied during the event creation.                                 |
| `LastModDateTime`         | string   | Optional     | The timestamp of the last modification made to the event.                                |
| `LastModBy`               | string   | Optional     | The individual or system that last modified the event.                                   |
| `LastModByID`             | string   | Optional     | The ID of the person or system who last modified the event.                              |
| `OwnedBy`                 | string   | Optional     | The owner of the security event.                                                         |
| `OwnedByID`               | string   | Optional     | The ID of the individual or team owning the security event.                              |
| `OwnedByTeam`             | string   | Optional     | The team responsible for managing the security event.                                    |
| `OwnedByTeamID`           | string   | Optional     | The ID of the team responsible for the security event.                                   |
| `EventOperationsID`       | string   | Optional     | The unique identifier for the operations performed on the event.                         |
| `ReportedBy`              | string   | Optional     | The person or system who reported the security event.                                    |
| `ReportedByEmail`         | string   | Optional     | The email address of the individual who reported the event.                              |
| `ReportedByPhone`         | string   | Optional     | The phone number of the individual who reported the event.                               |
| `Discovery`               | string   | Optional     | Information on how the security event was discovered.                                    |
| `EventCI`                 | string   | Optional     | The Configuration Item (CI) associated with the event.                                   |

### Input Example

`{"SecEventId":"100577"}`

### Output

| **Parameter** | **Type** | **Description**                  |
| ------------- | -------- | -------------------------------- |
| `status_code` | number   | HTTP status code of the response |
| `reason`      | string   | Response reason phrase           |

### Output Example

`{"status_code":200,"reason":"OK","response_headers":{},"json_body":{}}`

# Response Headers

| **Header**   | **Description**                                       | **Example**                   |
| ------------ | ----------------------------------------------------- | ----------------------------- |
| Content-Type | The media type of the resource                        | application/json              |
| Date         | The date and time at which the message was originated | Thu, 01 Jan 2024 00:00:00 GMT |